Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using AI-Powered Email Security Gateways
Transcript
- Lucas: Luna, I want to talk about something that sounds boring but is actually one of the most active areas in enterprise security right now: email security gateways. Specifically, the shift from rules-based filtering to ai native platforms. Luna: Okay, you had me at 'boring' — because for years, email security was basically a spam filter with a few regex rules. What changed? Lucas: What changed is that attackers got smart. Phishing evolved from 'prince needs your bank account' to highly targeted, context-aware business email compromise. A traditional secure email gateway — a SEG — might catch 90 percent of junk, but it misses the clever stuff: a CFO getting an email that looks exactly like a vendor invoice, with the right domain, the right language, no malicious link. Luna: Right, because there's no payload to scan. It's pure social engineering. So AI isn't looking at the attachment or the link — it's looking at the behavior. Lucas: Exactly. The new generation — companies like Abnormal Security and Avanan, which Check Point acquired a few years ago — they use what's called behavioral AI. They model the baseline relationship patterns between employees and their contacts. Who emails whom, at what time, what language they use, what kind of requests are normal. Luna: So when a compromised vendor account sends a message asking to change the payment routing number, the system flags it because the tone or the timing doesn't match the baseline. Lucas: Precisely. And it's not just one signal. They also look at the language itself using natural language processing. Is the email unusually urgent? Does it use phrases that the real person never uses? I read a case study about a mid-sized manufacturer — about 2,000 employees — that got hit with a BEC attack in early 2025. Luna: What happened? Lucas: One of their long-time suppliers had their email account compromised. The attacker sent a message to the AP department saying 'our bank changed, please wire the next payment to this new account.' The dollar amount was $340,000. The email came from the real domain, the language was professional, and it referenced an actual purchase order number. Luna: A traditional SEG would have let that through. No malicious attachment, no link, no red flags in the header. Lucas: Their legacy gateway — let's call it a major incumbent — did let it through. But their AI layer, which they'd deployed three months earlier, caught it in 800 milliseconds. It flagged the email because the supplier had never sent a payment change request before, and the language had a slightly higher urgency score than the historical average. Luna: That's a really concrete example. And I think a lot of listeners might not realize how fast this market is growing. What's the spending picture? Luna: And that growth is partly driven by the fact that Microsoft 365 and Google Workspace have their own built-in protections, but they're not enough. Enterprises are adding third-party layers on top. Lucas: That's the key insight. Microsoft Defender for Office 365 is decent for commodity threats, but it's not great at the tailored BEC or the zero-day phishing campaign. The ai native vendors integrate via API, so they sit alongside the built-in security and add a second opinion. They don't replace the mail flow — they read messages after delivery and can retroactively remove them if something is flagged. Luna: Right, that's important. The api based approach means no latency in email delivery. The message lands in the inbox, and then a fraction of a second later, the AI decides whether to pull it back. That's a big deal for user experience. Lucas: And it also means they can analyze the full context — not just the headers and attachments, but the entire thread, the relationship graph, the behavioral signals. Traditional SEGs that sit inline often have to make a quick pass or block decision and they don't have time to do deep analysis. Luna: So what are the trade-offs? I imagine false positives are still a concern. If the AI flags a legitimate email from a new client, that could be a problem. Lucas: It's a real concern. The vendors claim false positive rates below 0.01 percent, but in practice, every organization has different communication patterns. A sales team that constantly emails new prospects might see more false positives because their graph is more dynamic. The best platforms let you tune the sensitivity per department or even per user. Luna: And there's also the question of data privacy. These AI systems are analyzing the content of every email. That's a lot of trust to place in a third party. Lucas: Absolutely. That's one of the biggest friction points in procurement. CISOs have to do a thorough data protection impact assessment. Most of the vendors are SOC 2 Type II certified and offer data residency options, but the scrutiny is intense. In heavily regulated industries like healthcare and finance, some organizations still prefer on-premise SEGs for that reason, even if they're less effective. Luna: So we're seeing a split: the ai native cloud gateways for most enterprises, and legacy on-premise for the most sensitive. But over time, do you see the AI models getting good enough that privacy concerns diminish? Lucas: I think so, partly because the vendors are moving toward federated learning and on-device processing where possible. Microsoft is already embedding AI directly into Exchange Online so that some analysis happens without data leaving the tenant. That's the direction — keep the sensitive data local, but still benefit from the model. Luna: Before we wrap up, I want to touch on something you mentioned earlier — the incumbent vendors like Proofpoint and Mimecast. How are they responding? Lucas: They're acquiring and building. Proofpoint has invested heavily in AI, but their architecture is still mostly inline, which limits how much context they can use. Mimecast has a cloud-based service that's improving. But the startups have a speed advantage because they don't have to maintain backward compatibility with decades-old on-premise deployments. Luna: It's a classic innovator's dilemma. And for the customer, it means more choice and better detection, but also more vendors to evaluate. Lucas: Yeah, and speaking of evaluating — we keep this show completely ad-free because we believe this kind of analysis should be straightforward and not sponsored. If you find these episodes useful for your work or your team, you can support that choice at buy me a coffee dot com slash fexingo. It's a small way to keep this independent. Luna: Totally. And we appreciate everyone who does — it lets us keep digging into topics like this without any pressure to soften the critique. Lucas: Alright, so to bring it home: email security is having a moment. The combination of behavioral AI and api based architecture is catching attacks that even the best rules-based systems miss. For any security leader, this is probably the single highest roi investment they can make this year. Luna: And a good reminder that the oldest attack vector — email — is still the most dangerous. Thanks Lucas. Lucas: Thanks Luna. For our listeners, we'll be back with another episode tomorrow.